A Brief Overview of the Mobile App Ecosystem. September 13, 2012

Transcription

1 A Brief Overview of the Mobile App Ecosystem September 13, 2012

2 Presenters Pam Dixon, Execu9ve Director, World Privacy Forum Jules Polonetsky, Director and Co- Chair, Future of Privacy Forum Nathan Good, PhD, Chief Scien9st at Good Research Ron Soffer, Independent App Developer, former app developer for WebMD Adam Towvim & MaP Tengler, VP of Business Development & Product Director at Jumptap Lia Sheena, Legal & Policy Fellow at the Future of Privacy Forum

3 Agenda Mobile Ecosystem Chart App Business Models Mobile Web Browser Overview Mobile Applica9on Ecosystem Data that can be Collected Technical & ToS Permissions No9ce & Design Considera9ons More on types of data: Loca9on, Photos, & Contacts Iden9fiers & Tracking Tracking & Opt- out Op9ons Ques9ons

4 The Mobile Ecosystem What is poten:ally involved in a for- profit mobile app

5 App Business Models PAID DOWNLOADS FREE; AD SUPPORTED FREEMIUM; IN- APP COMMERCE FREE; IN- APP REFERRALS

6 Mobile Web Browsers Typical Mobile Browser Privacy Controls Clear cookies Clear history Clear local storage Safari Default browser on ios Third- party cookie limita9ons Clearing cookies also clears Local Storage Android "Browser" is default; users can manually install the Chrome browser app Mozilla Do Not Track func9onality in mobile browser on Android: Tell sites not to track me

7 Na9ve, Web, or Hybrid Apps Na9ve app (ios, Android, Java) Web app (HTML5) Hybrid App

8 Contacts Photo Library Videos Camera/Video Sensor Microphone Text Messages Dialer Calendar Items Loca9on Reminders User entered info Social Integra9on features Mobile App Ecosystem Data Collected Can Include:

9 Handling of Sensi9ve Data Health Financial Children

10 The Apple ios Approach App Store Review Plus Sandboxing For security reasons, ios places each app (including its preferences and data) in a sandbox at install 9me. A sandbox is a set of fine- grained controls that limit the app s access to files, preferences, network resources, hardware, and so on. As part of the sandboxing process, the system installs each app in its own sandbox directory, which acts as the home for the app and its data. Important The purpose of a sandbox is to limit the damage that a compromised app can cause to the system. Sandboxes do not prevent apacks from happening to a par9cular app and it is s9ll your responsibility to code defensively to prevent apacks. For example, if your app does not validate user input and there is an exploitable buffer overflow in your input- handling code, an apacker could s9ll hijack your app or cause it to crash. The sandbox only prevents the hijacked app from affec9ng other apps and other parts of the system. (ios Developer Library) hpp://developer.apple.com/library/ios/#documentation/iphone/conceptual/iphoneosprogrammingguide/theiosenvironment/theiosenvironment.html

11 Technical Consent/Permission Models: Apple ios When does the OS automa:cally trigger a request for user permission before providing data? Loca9on data Apps that need access to loca9on including apps with access to photos and videos Triggers opt- in consent pop- up prior to use Access to other data without declaring in ios5 API BUT new in ios6: app developer must request access to Photos, Contacts, Reminders, and Calendar access which will trigger opt- in consent pop- up Loca:on Status Arrow icon appears when loca:on is accessed

12 Apple ios Ability to Edit Permissions & Add New Permissions Loca9on Opt- in No9ce Access to loca9on always triggers a pop- up consent request Developer can edit and add informa9on about the request in the descrip9on Developer can Op9onally Trigger other Permissions, e.g. pop- up permission prior to accessing or uploading contacts onto a server

13 Technical Consent/Permission Models: Google Android Community Review Plus Per App Sandboxing Developer decides permissions that the app will have Permissions declared to user before install Permissions cannot be changed while the program is running, they are sta9c Permissions allow for granular access and control of various parts of the phone as well as customer data Apps can be downloaded from the default Google Play app store or from independent app store

14 Sekng Permissions on Android Ac:ons Permissions Personal Info Permissions Hardware Sensor Permissions Determine permissions needed Describe permissions needed Display permissions to user User chooses to install or not System Ac9ons Permissions

15 Android Permissions: Sekng them up Developer creates a file called a manifest that has the permissions

16 Android Permissions What the User Sees

17 Technical Consent/Permission Models: Google Android Up Front No9ce designed to: Limit dialog boxes Provide transparency on programs ac9ons before install Give the user install/don t install choice before installa9on Be decided on before the program runs Security Architecture Limita9ons Reliance on one 9me customer consent and user apen9on upfront Android has no mechanism for gran9ng permissions dynamically (at run- 9me) because it complicates the user experience to the detriment of security. hpp://developer.android.com/guide/topics/security/ permissions.html

18 Terms of Service Consent Rqmts Apple ios You must provide clear and complete informa9on to users regarding Your collec9on, use and disclosure of user or device data. Sec$on of the ios Developer Program License Agreement. If consent is denied or withdrawn, Applica9ons may not collect, transmit, maintain, process or u9lize such data or perform any other ac9ons for which the user s consent has been denied or withdrawn. Sec$on of the ios Developer Program License Agreement. Google Android If the users provide you with, or your Product access or uses, user names passwords, or other log- in or personal informa9on, you must make users aware that this informa9on will be available to your app, and you must provide legally adequate privacy no9ce and protec9on for those users. Further, your Product may only use that informa9on for the limited purposes for which the user has given you permission to do so. Sec$on 4.3 of the Android Market Developer Distribu$on Agreement. MicrosoQ If your app enables access to and the use of any Internet- based services, or otherwise collects or transmits any user s personal informa9on, you must maintain a privacy policy Your privacy policy must (i) comply with applicable laws and regula9ons, (ii) inform users of the informa9on collected by your app and how that informa9on is used, stored, secured and disclosed, and (iii) describe the controls that users have over the use and sharing of their informa9on, and how they may access their informa9on. You must also provide access to your privacy policy in the app s sekngs as displayed in the Windows sekngs charm. Sec$on 3(f) of the App Developer Agreement.

19 Addi9onal (Op9onal) No9fica9ons Adding No:ce in Context outside of regular permissions

20 No9ce Design Considera9ons Screen Constraints Push no9fica9ons More than just popups, exploring alternate designs

21 Loca9on GPS Wi- Fi Cell towers Carriers and services that work with carriers, e.g. Locaid (subject to CTIA guidelines) Coarse loca9on (Android) Future? NFC

22 Contacts/Address Book Apple s ToS require app developers to request for access but not a technical permission yet (will be in ios6) Android s ToS require app developer no9fy user of personal info available to the app which is technical permission to read all of the contact (address) data stored on your phone

23 Photos & Calendar Photo/Video Library Android doesn t currently have a specific permission for photo or videos; obtain access to photos and videos by reques9ng permission to read data from storage cards subject to change ios triggers a loca9on permission upon reques9ng access to ALAssetsLibrary Calendar & Reminders Access to calendar on most mobile OSs, e.g. ios, Android, and Windows Cannot request access to phone reminders on ios5, but will be able to in ios6

24 Social Integra9on Features Facebook Connect Apple Game Center TwiPer sharing Google+ DeNa s Mobage Gree s Open Feint Papaya PlayPhone

25 Working with Third Par9es Analy9cs SDK Ad networks SDK Other intermediaries Behavioral Adver9sing Data appending Exploits and abuses

26 What Types of Data do Ad Networks Data App Mobile Web Device Type Opera9ng System App / URL Mobile Network IP Address Mobile Browser Carrier ID Device ID Loca9on Data Ad(s) Supported Conversions Typically Receive? Notes When on 2/3/4G connec9on, IP based Server- to- server ad calls a challenge Accessed via hpp headers UDID, Android ID, new ios ASAdver9ser Manager, etc. Granularity varies based on user/ publisher, but access to precise geographic loca9on only if app obtained user s consent Dimensions, MRAID, VAST Data sharing varies across app / web

27 Iden9fiers & Tracking App cookies are sandboxed Concerns around the use of device iden9fiers for app tracking Security Mechanisms for device iden9fiers Google AdMob requires that app developers send back hashed values of the UDID Many leading ad networks now hash the iden9fiers they receive on Android and ios Types of Iden9fiers Include: Android ID; can be wiped upon factory reset Apple UDID; linked to device, no controls to modify In August 2011, Apple announced plans to deprecate UDID access ios6 provides alterna9ve iden9fier that can reset by the user MAC Address; linked to device hardware, no controls to modify IMEI MEID Using ios Pasteboard Device Fingerprin9ng

28 Tracking & Opt- out Op9ons Disparate iden9fiers = disparate opt- out solu9ons Mobile ad networks and other leading companies have begun to offer opt- outs No consistent and single opt- out across app and mobile web Mul9ple steps to opt- out Device iden9fier not easily accessible by user Crea9ng awareness of available opt- outs FPF lists some companies that currently provide mobile opt- mobileprivacyop:ons.org

29 Tracking & Opt- out Op9ons Flurry opt-out Apple iad opt-out Jumptap opt-out Google AdMob Opt-out LeadBolt opt-out app

30 BREAKING NEWS: New Privacy Controls in ios6 Limit Ad Tracking is off by default. When the user turns it on, the iden9fier for adver9sers, ASAdver9serManager, can only be used for the following purposes: frequency capping, conversion events, es9ma9ng the number of unique users, security and fraud detec9on, and debugging.

31

32 Research for this presenta:on was prepared by Lia Sheena and Nathan Good with input from presenters.